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By the NASA Investigation Board 

At approximately 63 seconds into the flight 
of Skylab 1 on May 14, 1973, an anomaly oc- 
curred which resulted in the complete loss of 
the meteoroid shield around the orbital 
workshop. This was followed by the loss of 
one of the two solar array systems on the 
workshop and a failure of the interstage 
adapter to separate from the S-II stage of the 
Saturn V launch vehicle. The investigation 
reported herein identified the most probable 
cause of this flight anomaly to be the 
breakup and loss of the meteoroid shield due 
to aerodynamic loads that were not account- 
ed for in its design. The breakup of the mete- 
oroid shield, in turn, broke the tie downs 
that secured one of the solar array systems to 
the workshop. Complete loss of this solar ar- 
ray system occurred at 593 seconds when the 
exhaust plume of the S-II stage retro-rockets 
impacted the partially deployed solar array 
system. Falling debris from the meteoroid 
shield also damaged the S-II interstage 
adapter ordnance system in such a manner 
as to preclude separation. 

Of several possible failure modes of the 
meteoroid shield that were identified, the 
most probable in this particular flight was 
internal pressurization of its auxiliary tun- 
nel which acted to force the forward end of 
the meteoroid shield away from the shell of 
the workshop and into the supersonic air 
stream. The pressurization of the auxiliary 
tunnel was due to the existence of several 
openings in the aft region of the tunnel. An- 
other possible failure mode was the separa- 
tion of the leading edge of the meteoroid 
shield from the shell of the workshop (par- 
ticularly in the region of the folded ordnance 
panel) of sufficient extent to admit ram air 
pressures under the shield. 

The venting analysis for the auxiliary 
tunnel was predicated on a completely sealed 
aft end; the openings in the tunnel thus re- 
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suited from a failure of communications 
among aerodynamics, structural design, and 
manufacturing personnel. The failure to 
recognize the design deficiencies of the mete- 
oroid shield through six years of analysis, 
design and test was due, in part, to a pre- 
sumption that the shield would be “tight to 
the tank” and “structurally integral with the 
S-IVB tank” as set forth in the design crite- 
ria. In practice, the meteoroid shield was a 
large, flexible, limp system that proved diffi- 
cult to rig to the tank and to obtain the close 
fit that was presumed by the design. These 
design deficiencies of the meteoroid shield, 
as well as the failure to communicate within 
the project the critical nature of its proper 
venting, must therefore be attributed to an 
absence of sound engineering judgment and 
alert engineering leadership concerning this 
particular system over a considerable period 
of time. 

The overall management system used for 
Skylab was essentially the the same as that 
developed in the Apollo program. This sys- 
tem was fully operational for Skylab; no con- 
flicts or inconsistencies were found in the 
records of the management reviews. None- 
theless, the significance of the aerodynamic 
loads on the meteoroid shield during launch 
were not revealed by the extensive review 
process. Possibly contributing to this over- 
sight was the basic view of the meteoroid 
shield as a piece of structure, rather than as 
a complex system involving several different 
technical disciplines. Complex, multidisci- 
plinary systems such as the meteoroid shield 
should have a designated project engineer 
who is responsible for all aspects of analysis, 
design, fabrication, test and assembly. 

The Board found no evidence that the de- 
sign deficiencies of the meteoroid shield were 
the result of, or were masked by, the content 
and processes of the management systems 
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that were used for Skylab. On the contrary, 
the rigor, detail, and thoroughness of the sys- 
tems are doubtless necessary for a program 
of this magnitude. At the same time, as a 
cautionary note for the future, it is empha- 
sized that management must always be alert 
to the potential hazards of its systems and 
take care that an attention to rigor, detail 
and thoroughness does not inject an undue 
emphasis on formalism, documentation, and 
visibility in detail. Such an emphasis can 
submerje the concerned individual and de- 
press the role of the intuitive engineer or 
analyst. It will always be of importance to 
achieve a cross-fertilization and broadened 
experience of engineers in analysis, design, 
test or operations. Positive steps must al- 
ways be taken to assure that engineers be- 
come familiar with actual hardware, develop 
an intuitive understanding of computer- 
developed results, and make productive use 
of flight data in this learning process. The 
experienced chief engineer, who can spend 
most of the time in a subtle integration of all 
elements of the system under purview, free 
of administrative and managerial duties, 
can also be a major asset to an engineering 
organization. 

The Skylab program 

Skylab missions have several distinct goals: 
to conduct Earth resources observations, 
advance scientific knowledge of the sun and 
stars, study the effects of weightlessness on 
living organisms, particularly human, and 
study and understand methods for the 
processing of materials in the absence of 
gravity. The Skylab mission utilizes the as- 
tronaut as an engineer and as a research 
scientist, and provides an opportunity for 
assessing potential human capabilities for 
future space missions. 

Skylab uses the knowledge, experience 
and technical systems developed during the 
Apollo program along with specialized equip- 
ment necessary to meet the program objec- 
tives. 


Figure 1 shows the Skylab in orbit. Its 
largest element is the orbital workshop, a 
cylindrical container 48 feet long and 22 feet 
in diameter weighing some 78,000 pounds. 
The basic structure of the orbital workshop 
is the upper stage, or S-IVB stage, of the S-IB 
and S-V rockets which served as the Apollo 
program launch vehicle. The orbital work- 
shop has no engines, except attitude control 
thrusters, and has been modified internally 
to provide a large orbiting space laboratory 
and living quarters for the crew. The Sky- 
lab 1 (SL-1) space vehicle included a payload 
consisting of four major units — orbital work- 
shop, airlock module, multiple docking 
adapter, Apollo telescope mount — and a 
two-stage Saturn-V (S-IC and S-II) launch 
vehicle as depicted in Figure 2. To provide 
meteoroid protection and thermal control, an 
external meteoroid shield was added to cover 
the orbital workshop habitable volume. A 
solar array system (SAS) was attached to the 
orbital workshop to provide electrical power. 

The original concept called for a “wet 
workshop.” In this concept, a specially con- 
structed S-IVB stage was to be launched 
“wet” as a propulsive stage on the S-IB 
launch system filled with propellants. The 
empty hydrogen tank would then be purged 
and filled with a life-supporting atmosphere. 
A major redirection of Skylab was made on 
July 22, 1969, six days after the Apollo 11 
lunar landing. As a result of the successful 
lunar landing, S-V launch vehicles became 
available to the Skylab program. Conse- 
quently, it became feasible to completely 
equip the S-IVB on the ground for immediate 
occupancy and use by a crew after it was in 
orbit. Thus it would not carry fuel and 
earned the name of “dry workshop.” 

The nominal Skylab mission called for 
the launch of the unmanned S-V vehicle and 
workshop payload SL-1 into a near -circular 
(235 nautical miles) orbit inclined 50 degrees 
to the equator. About 24 hours after the first 
launch, the manned Skylab 2 (SL-2) launch 
would take place using a command service 
module payload atop the S-IB vehicle. After 
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the command service module rendezvous and 
docking with the orbiting cluster, the crew 
enters and activates the workshop; Skylab is 
then ready for its first operational period of 
28 days. At the end of this period, the crew 
returns to Earth with the command service 
module, and the Skylab continues in an 
unmanned quiescent mode for some 60 days. 
The second three-person crew is launched 
with a second S-IB, this time for a second 
56-day period in orbit after which they will 
return to Earth. The total Skylab mission 
activities cover a period of roughly eight 
months, with about 140 days of manned 
operation. 


The Flight of Skylab 1 

Skylab 1 was launched at 1730:00 (range 
time, R = 0) on May 14, 1973, from Complex 
39 A, Kennedy Space Center. At this time, 
the Cape Kennedy launch area was exper- 
iencing cloudy conditions with warm tem- 
peratures and gentle surface winds. Total 
sky cover consisted of scattered cumulus at 
2,400 feet, scattered stratocumulus at 5,000 
feet, broken altocumulus at 12,000 feet, and 
cirrus at 23,000 feet. During ascent, the 
vehicle passed through the cloud layers but 
no lightning was observed in the area. Upper 
area wind conditions were being compared to 


General Characteristics 

Condition work volume 12,700 cu ft (354 cubic meters) 
Overall length 117 ft (35.1 meters) 

Weight including CSM 199,750 (90,606 Kilograms) 
Width OWS including solar array 90 ft (27 meters) 
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Figure 1 Skylab Cluster 
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PS Payload Shroud 

Diameter 6.6 meters (21.7 feet) 

Length 16.8 meters 

Weight 11,794 kilograms (26,000 lbs.) 

ATM Apollo Telescope Mount 
Wi Width 3.3 meters 

Length 4.4 meters 

Weight 11.181 kilograms (24,650 lbs.) 

MDA Multiple Docking Adapter 
Diameter 3 meters (lo feet) 

Length 5.2 meters (17.3 feet) 

Weight 6,260 kilograms (13,800 lbs.) 

AM Airlock Module 

Diameter STS 3 meters (10 feet) 

Diameter FAS 6.6 meters (21,7feet) 

Length 5.3 meters (17.5 feet) 

Weight 22,226 kilograms (49,000 lbs.) 

IU Instrument Unit 

Diameter 6.6 meters (21.7 feet) 

Length 0.9 meter (3 feet) 

Weight 2,064 kilograms (4,550 lbs.) 

OWS Orbital Workshop 

Diameter 6.6 meters (21.7 feet) 

Length 14.6 meters (48.5 feet) 

Weight 35,380 kilograms (78,000 lbs.) 

S-II Second Stage 

Diameter 10 meters (33 feet) 

Length 24.8 meters (81.5 feet) 

Weight 488,074 kilograms (1,076,000 lbs.) 
fueled 

35,403 kilograms (78,050 lbs.) dry 
Engines J-2 (5) 

Propellants: Liquid Oxygen 333,837 liters 

(88,200 gallons) 

Liquid Hydrogen 1,030,655 
liters (272,300 gallons) 

Thrust 5,150,000 Newtons (1,150,000 lbs.) 
Interstage Approx. 5,171 kilograms (11,400) 
lbs.) 

S-IC First Stage 

Diameter 10 meters (33 feet) 

Length 42 meters (138 feet) 

Weight 2,245,320 kilograms (4,950,000 lbs.) 
fueled 

130,410 kilograms (287,500 lbs.) dry 
Engines F-l (5) 

Propellants: Liquid Oxygen 1,318,315 liters 

(348,300 gallons) 

RP-1 (Kerosene) 814,910 liters 
(215,300 gallons) 

Thrust 31,356,856 Newtons (7,723,726 lbs.) 


Figure 2 SL-1 vehicle 
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most other Saturn-V flights. The flight envi- 
ronment was quite favorable. 

The automatic countdown proceeded nor- 
mally with Guidance Reference Release oc- 
curring at R-17.0 seconds and orbit insertion 
occurring at R + 599.0 seconds. The orbital 
workshop solar array deployment was com- 
manded on time; however, real-time data in- 
dicated that the system did not deploy fully. 

The solar array system (SAS) on the or- 
bital workshop consists of two large beams 
enclosing three major sections of solar cell 
assemblies within each. During ascent, the 
sections are folded like an accordion inside 
the beams which in turn are stowed against 
the workshop. The meteoroid shield is a 
lightweight structure wrapped around the 
converted S-IVB stage orbital workshop and 
is exposed to the flight environment. The two 
hinged solar array system wings are secured 
to the orbital workshop by tie downs above 
and below the meteoroid shield. Seals at- 
tached to the solar array system perimeter 
actually press against the shield to form an 
airtight cavity prior to launch. Once in orbit, 
the solar array system beams are first de- 
ployed out 90 degrees. The meteoroid shield 
is deployed later to a distance of about five 
inches from the orbital workshop wall. After 
the ordnance release is fired, meteoroid 
shield deployment is effected by torsion rods 
and swing links spaced around the structure 
fore and aft. The rods are torqued prior to 
launch and simply unwind in orbit to move 
the meteoroid shield away from the tank, 
Detection of pertinent conditions associated 
with the meteoroid shield and solar array 
system is afforded by measuring various pa- 
rameters by telemetered instrumentation. 

When the orbital workshop solar array 
system was commanded to deploy, telemeter- 
ed data indicated that events did not occur as 
planned. The flight data was analyzed by 
flight operations personnel to reveal the pos- 
sible source of the problem. At about R + 60 
seconds, the S-II telemetry reflected power 
increased slightly. At about 63 seconds, 
numerous measurements indicated the 


apparent early deployment and loss of the 
meteoroid shield. At this time, the vehicle 
was at about 28,600 feet altitude and at a 
velocity of about Mach 1. 

At this time, vehicle dynamic measure- 
ments such as vibration, acceleration, atti- 
tude error, and acoustics indicated strong 
disturbances. Measurements which are nor- 
mally relatively static at this time, such as 
torsion rod strain gauges, tension strap 
breakwires, temperatures, and solar array 
system position indicators, indicated a loss of 
the meteoroid shield and unlatch of the 
SAS-2 wing. Further preliminary evaluation 
revealed abnormal vehicle accelerations, vi- 
brations, and solar array system tempera- 
ture and voltage anomalies at about R + 593 
seconds. Temperature data loss and sudden 
voltage drops indicated that the SAS-2 wing 
was separated from the orbital workshop at 
this time. Other data later in the flight indi- 
cated the SAS-1 wing did not fully deploy 
when commanded to do so. Although not ap- 
parently associated with the 63-second and 
593-second anomalies, the S-II stage range 
safety receiver signal strengths showed sev- 
eral drops throughout the flight beginning at 
about R + 260 seconds. 

63-Second anomaly: Loss of 
Meteroid Shield 

The Investigation Board evaluated the te- 
lemetry data in order to explain the various 
anomalies that occurred on Skylab 1. The 
first anomalous indication was an increase 
in S-II telemetry reflected power from a 
steady 1.5 W beginning at R + 59.80 seconds. 
At this time the telemetry forward power 
remained steady at 58.13 W. By 61.04 sec- 
onds, the reflected power had reached 
1.75 W, and by 80.38 seconds, the reflected 
power had stabilized at about 2.0 W. This 
abnormal increase in power might be in- 
dicative of a vehicle physical configuration 
change which altered the antenna ground 
plane characteristic. 
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Shortly after the telemetry reflected 
power increase, the meteoroid shield torsion 
rod? forward (measurement G7036) indicat- 
ed a slight change toward the deployed 
condition. This occurred at R + 60.12 sec- 
onds, and at 61.78 seconds the vehicle roll 
rate decreased slightly from a normal value 
of 1.1 degrees per second clockwise looking 
forward. The next torsion rod 7 forward 
sample at about 62.52 seconds revealed a 
further relaxation. The increase in telemetry 
reflected power and the movement of torsion 
rod 7 forward tend to indicate meteoroid 
shield lifting between positions I and II. 

Between R + 62.75 and 63.31 seconds, 
several vehicle dynamic measurements 
indicated a significant disturbance. A sensor 
on the orbital workshop film vault showed an 
abnormal vibration at 62.75 seconds fol- 
lowed by disturbances sensed by X and Y 
accelerometer pickups in the instrument 
unit, the pitch, yaw, and longitudinal 
accelerometers, and the pitch, yaw, and roll 
rate gyros. At 62.78 seconds, the roll rate 
gyro sensed a sudden clockwise roll rate re- 
sulting in a peak amplitude of 3.0 degrees 
per second clockwise 62.94 seconds. A sensor 
at the instrument unit upper mounting 
showed a maximum peak-to-peak shock of 
17.2 g’s at 63.17 seconds. In addition, the S-II 
engine actuators experienced pressure fluc- 
tuations caused by vehicle movement 
against the inertia of the non-thrusting 
engine nozzles. 

The data indicate that the most probable 
sequence of meteoroid shield failure was 
initial structural failure of the meteoroid 
shield between the SAS-2 wing and the main 
tunnel (between positions I and II). The 
initial failure propagation from this area 
appears likely since the wardroom window 
thermocouple indication (C7013) remained 
normal at 62.94 seconds after SAS-2 indicat- 
ed unlatched at 62.90 seconds and after the 
K7010 and K7011 tension strap measure- 
ments failed. 


593-Second Anomaly 

As a consequence of the meteoroid shield 
failure at approximately 63 seconds, the 
SAS-2 wing was unlatched and partially de- 
ployed as evidenced by minor variations in 
the main solar array system electrical volt- 
ages and SAS-2 temperatures. Full deploy- 
ment was prevented due to the aerodynamic 
forces and accelerations during the remain- 
der of powered flight. 

At the completion of the S-II phase of 
flight, the four 35,000-pound thrust retro- 
rockets fired for approximately two seconds 
commencing at R + 591.10 seconds followed 
by spacecraft separation at 591.2 seconds. 
The effect of retro-rocket plume impinge- 
ment was observed almost immediately on 
the SAS-2 temperature and on vehicle body 
rates. 

At 593.4 seconds the wing imparted mo- 
mentum to the vehicle, probably by hitting 
and breaking the 90 degree fully deployed 
stops, and at 593.9 imparted a final kick as it 
tore completely free at the hinge link. In- 
orbit photographs show clearly the hinge 
separation plane and the various wires 
which were torn loose at the interface. 

Interstage Second Plane 
Separation Anomaly 

Post-flight analysis revealed unexpectedly 
high temperatures and pressures in the S-II 
engine compartment following ignition and 
continued high after interstage separation 
command. The unusually high temperatures 
from S-II ignition and until the S-II inter- 
stage separation signal are considered by 
Marshall Space Flight Center (MSFC) to be 
caused by a change in the engine heat shield 
skirts introduced on this flight, and there- 
fore do not indicate a problem. However, the 
increasing temperatures after the time of 
normal S-II interstage separation are indica- 
tive of an abnormal condition. More detailed 
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investigation based on performance evalua- 
tion and axial acceleration time history re- 
vealed that the interstage had not been 
jettisoned; however, due to the vehicle per- 
formance characteristics and performance 
margin, the desired orbit was achieved. 

Data analysis confirms that the primary 
ordnance command was properly issued at 
R+ 189.9 seconds. The backup command was 
issued 100 milliseconds later but the explod- 
ing bridge wire circuit discharge was charac- 
teristic of an open circuit consistent with 
separation of the interstage disconnect by a 
minimum of 0.25 inch. 

The linear shaped charge is mounted cir- 
cumferentially around the S-II interstage. 
When fired by the primary command, the 
charge cuts the tension straps (in the direc- 
tion of position II to position I) allowing the 
skirt to drop away. Normal propagation time 
of the linear shaped charge is approximately 
four milliseconds. Assuming a failure to 
propagate completely around the structure, 
analyses were made by appropriate contrac- 
tor and government personnel to determine 
what area must remain intact in order to re- 
tain the skirt and what area must have been 
cut to allow rotation of the skirt sufficient to 
disconnect the connector panel. The various 
analyses isolate the region of failure to an 
arc extending from approximately © = 100 
degrees to as much as 0 = 200 degrees. 

This ordnance installation was different 
from prior Saturn flights. Previously, a sin- 
gle fire command from the instrumentation 
unit was issued which simultaneously deto- 
nated the linear shaped charge from both 
ends allowing the charge to propagate from 
both directions. On this flight, in an attempt 
to provide redundant firing commands, the 
detonators at each end of the linear shaped 
charge were separately connected to two 
command channels spaced 100 milliseconds 
apart due to the characteristics of the air- 
borne equipment. As a result of the partial 
cutting of the interstage, it rotated suffi- 
ciently to separate the electrical connector 
prior to issuing the backup command. 


A review of the history of manufacturing, 
acceptance, checkout, qualification and 
flight environment revealed no basic cause 
for failure. The most probable cause is secon- 
dary damage as a result of the meteoroid 
shield failure, attributed to falling debris as 
evidenced by the various shock and acoustic 
disturbances occurring in the 63-second time 
period. 

The redundant mode of ordnance opera- 
tion of all prior Saturn flights in which both 
ends of the linear shaped charge are fired at 
once from a single command would probably 
have prevented the failure, depending on the 
extent of damage experienced by the linear 
shaped charge. 

Forward Interstage Internal 
Pressure Anomaly 

Flight data indicated a deviation of the S-II 
forward interstage pressure from analytical 
values commencing at approximately 63 sec- 
onds. Inasmuch as the deviation from the 
analytical curve of the internal pressure ver- 
sus time appeared to be coincident with the 
meteoroid shield failure, it was postulated 
that a portion of the shield had punctured 
the forward interstage. On this basis, it was 
possible to correlate the flight data with ei- 
ther an assumed 2.0 square foot hole in the 
conical section or an assumed 0.75 square 
foot hole in the cylindrical section. 

Range Safety Receiver Anomaly 

During the S-II portion of the flight, the sig- 
nal strength indications from both range 
safety receivers showed drops in level. From 
liftoff through R + 259 seconds, both receiv- 
ers maintained relatively stable values 
above range requirements. At R + 259.57 
seconds, receiver 2 signal strength began to 
drop and between this time and 522.1 sec- 
onds, both receivers indicated various de- 
grees of signal strength shift. These signal 
strength shifts dropped below the 12 db safe- 
ty margins required by Air Force Eastern 
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Test Range Manual 127-1. At R + 327.81 sec- 
onds the receiver 2 signal strength dropped 
briefly below its threshold sensitivity. At 
this instant this receiver probably would not 
have responded to any range safety com- 
mands. Receiver 1 was, however, capable of 
receiving commands. At R + 521.16, receiv- 
er 2 strength again dropped briefly to its 
threshold sensitivity. None of these drops 
could be correlated to ground system perfor- 
mance. 

Analysis indicates that the most probable 
cause of the S-II receiver signal strength 
dropout was a variable phase shift within 
the vehicle’s hybrid coupler due to the chang- 
ing aspect angle produced by the moving 
vehicle and the fixed transmitting site. Be- 
cause the decrease in receiver signal 
strength occurred with only one receiver at a 
time, range safety commands could have 
been received continuously throughout pow- 
er flight. During two of these drops, however, 
the planned redundancy of range safety re- 
ceivers was not available. 

During this investigation, it was revealed 
that the Wallops Island and Bermuda 
ground stations did not continuously record 
ground transmitter power levels. The Board 
considers that such continuous recordings 
would be of value. 

The Meteoroid Shield Design 

Although fairly simple in concept, the mete- 
oroid shield had to provide such a variety of 
functions that it was, in fact, a quite compli- 
cated device. It was, foremost, a very lightly 
built cylindrical structure 270 inches in di- 
ameter (in the deployed condition) by 265 
inches long. 

In brief, the meteoroid shield is formed of 
a set of sixteen curved sheets of 2014 T6 alu- 
minum panels, 0.025 inches thick, assem- 
bled at flanges and other fittings to form the 
cylinder shown. The forward and aft ends 
were reinforced with curved 7075 T6 angles. 

Various special details were included in 
the assembly in order to hold it in place, 


deploy it in orbit, and provide access to the 
orbital workshop interior during prelaunch 
activities. The principal means of holding 
the shield in place in orbit (and to a lesser 
extent during powered flight) was a set of 
tension straps under the main tunnel. These 
straps were bonded to the orbital workshop 
wall and fitted with a hinge on each end to 
take the butterfly hinge that attaches to the 
adjacent meteoroid shield panel. These 
butterfly hinges were designed to rotate so 
as to lie against the sides of the main tunnel 
which enclosed the tension straps and var- 
ious cable runs on the orbital workshop. 

Clockwise from the tension straps and 
butterfly hinge, the next special feature is 
the auxiliary tunnel. This tunnel extends in 
an arch between panels of the thin meteoroid 
shield. The 28 titanium frames of this tunnel 
provide a very springy section in the rela- 
tively rigid hoop provided by the rest of the 
shield. The auxiliary tunnel also encloses a 
smaller tunnel covering the wiring for the 
thruster attitude control system. Farther 
around, in position I, there are two curved 
rectangular smaller panels, included to pro- 
vide access to the orbital workshop. 

Between positions I and IV, the two 
halves of the meteoroid shield overlap and 
are joined by a series of 14 trunnion bolts and 
straps. These trunnion bolts were used to ad- 
just the tension with which the shield was 
held against the orbital workshop. Adjusting 
the bolts in the trunnion assemblies was a 
major aspect in positioning and tightening 
the meteoroid shield against the orbital 
workshop (rigging). 

In order to provide the extra 30 inches of 
perimeter required when the meteoroid 
shield was deployed, a foldout panel assem- 
bly is included in the panel adjacent to the 
trunnions. The only remaining distinctive 
features of the meteoroid shield are the 
panels located over the scientific airlock and 
wardroom window at position III. The mete- 
oroid shield is completed at the butterfly 
hinges and tension straps at position I. 
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Deployment Provisions 

The deployment of the 265-inch-long meteor- 
oid shield was accomplished by providing 
two folding panel sections on each side of a 
contained explosive pyrotechnic chain which 
extended axially for the full length of the 
shield except for short end reinforcements. 
When the ordnance strip is fired and sepa- 
rates the fold-over panel, the segments are 
released and the shield is deployed. After re- 
lease of this folded panel, a number of swing 
arms are used to displace the shield away 
from the orbital workshop wall and hold it 
there. A rotational force is applied to these 
swing arms by a total of sixteen torsion rods 
suitably spaced around the ends of the mete- 
oroid shield. When the meteoroid shield is 
stowed for launch, there is a larger twist in 
the torsion rods than after deployment. The 
links on one side of the ordnance chain swing 
in a direction opposite to those on the other 
side. The butterfly hinges on each side of the 
main tunnel permit the radial displacement 
of the shield at the location of the tension 
straps. 

The meteoroid shield should therefore be 
regarded as a very limp system, which de- 
pends on being stretched tight around the 
orbital workshop to withstand the aerody- 
namic, vibratory, flutter and thrust loads at 
launch. After deployment, it needs very little 
strength to serve its primary objective as a 
meteoroid shield. 

The Auxiliary Tunnel 

The auxiliary tunnel extends from the for- 
ward skirt, down the full length of the mete- 
oroid shield shield, and below the meteoroid 
shield by about 57 inches. Venting of this 
tunnel was provided through an outlet of 10 
square inches under the corrugations of the 
tunnel cover at the aft end of the forward 
fairing. The tunnel was intended to be sealed 
at the aft end by a rubber boot assembly in 
both the stowed and deployed position. Note 
that the tunnel is displaced some 5 or 6 


inches circumferentially upon deployment of 
the shield. 

The main structural members of the aux- 
iliary tunnel are titanium, arch-shaped, 
frame springs. These frames provide the 
structural tie between two meteoroid shield 
panels and provide both regulation of the 
pre-loading of the meteoroid shield to the 
orbital workshop and act as a flexible relief 
for diametrical changes resulting from ther- 
mal and pressure changes of the orbital 
workshop. 

The tunnel also serves to protect the 
thrust attitude control system cables located 
in a small channel-shaped cover permanent- 
ly attached to the orbital workshop. A seg- 
mented and corrugated outer skin form an 
aerodynamic fairing for the complete system 
and seals between forward and aft fairings. 

Thermal Control 

Although the primary purpose of the meteor- 
oid shield is that of providing protection of 
the orbital workshop from meteoroids, it also 
plays a significant role in the thermal con- 
trol system. Much of the overall thermal de- 
sign was accomplished passively by painting 
the outer surfaces of the meteoroid shield 
black except for a large white cross-shaped 
pattern on the Earth side during flight. The 
entire surface of the orbital workshop wall 
was covered with gold foil. The overall choice 
of finishes biased the thermal design toward 
the cold side, it being easier to vernier con- 
trol by heating rather than cooling. 

Friction between the Meteoroid Shield 
and Orbital Workshop Wall 

To provide a uniform tension throughout the 
meteoroid shield upon assembly and rigging 
for flight, and to permit transfer of the trun- 
nion bolt tension into the frames of the auxil- 
iary tunnel, it was necessary to minimize 
friction between the shield and the external 
surface of the orbital workshop. This was 
accomplished by applying a Teflon coating to 
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the entire inner surface of the meteoroid 
shield assembly. Special care was also taken 
to assure that all fastening rivets be either 
flush with or below the Teflon surface of the 
shield. In addition to considerations of 
friction, the elimination of rivet head 
protrusions was important in not damaging 
the rather delicate gold surface used to pro- 
vide the proper emissivity of the outer orbit- 
al workshop wall surfaces as mentioned 
above. This was a vapor-deposited gold sur- 
face applied to a Kapton backing and bonded 
to the outer workshop wall with an adhesive. 

Panel Details 

The sixteen panels comprising the meteoroid 
shield were formed of 0.025 inch thick alumi- 


num stock fitted with doublers and angles to 
permit their assembly. In each of these panel 
joints, 96 holes of 1/8-inch diameter were 
drilled to vent any air trapped under the me- 
teoroid shield skin. The special panel joint is 
required next to the SAS-1 wing because of 
the unavailability of sufficiently wide panel 
stock for the panel under SAS-1. It was a 
strap of metal of this special joint that be- 
came embedded in the SAS-1 cover and pre- 
vented automatic deployment of SAS-1 in or- 
bit. It is, perhaps, of passing interest to note 
the longer length of exposed bolts in this par- 
ticular joint. 

Around the top of the panels is located an 
angle and a neoprene rubber rain or weather 
seal. This seal was not intended to be an 
aerodynamic seal and could not be expected 
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to accommodate significant relative deflec- 
tions between the orbital workshop and me- 
teoroid shield surfaces. To provide meteoroid 
protection at the two ends of the meteoroid 
shield, small strips of thin stainless steel 
“fingers” were squeezed down between the 
orbital workshop and the meteoroid shield 
when stowed. The thrust load of the shield, 
which weighs some 1200 pounds, is trans- 
ferred to the forward flange of the aft skirt 
through a group of twelve thrust blocks. 

SUMMARY AND RECOMMENDATIONS 

The preceding analysis and discussion of pos- 
sible failure modes of the meteoroid shield 
have identified at least two ways that it 
could fail in flight. Although the most prob- 
able cause of the present failure was the lift- 
ing of the shield from the orbital workshop 
tank by excessive pressures in the auxiliary 
tunnel, other failure modes could have oc- 
curred in other regions of flight or under 
more severe flight environments that were 
encountered by Sky lab 1. 

Among these other modes of potential 
failure, which could combine in various ways 
under varying conditions of flight, are exces- 
sive pressures under the forward edge of the 
shield, or inadequate venting of the folded 
ordnance panel. The inherently light spring 
force of the auxiliary tunnel frames, the 
crushing loads on these frames in flight, the 
inherent longitudinal flexibility of the shield 
assembly, the forces applied by the swing 
links to deploy the shield, the possible 
breathing of the shield panels as cavities are 
vented, the noncylindrical nature of the un- 
derlying pressurized tank, and the uncertain 
tension loads applied to the shield in rigging 
for flight all contribute to a lack of rigidity of 
the shield and a weakness of its structural 
integrity with the underlying tank struc- 
ture. 

A simple and straightforward solution to 
these inherent problems of the present shield 
design is therefore not likely. A fundamen- 
tally different design concept seems in order. 


One solution is, of course, to simply omit the 
meteoroid shield, suitably coat the orbital 
workshop for thermal control and accept the 
meteoroid protection afforded by the orbital 
workshop tank walls. Although the Board 
has not conducted an analysis, meteoroid 
flux levels are now known to be considerably 
lower than those used in the original calcula- 
tions. A new analysis, based on these flux 
levels, may show acceptable protection. 

Should some additional meteoroid protec- 
tion be required, the Board is attracted to the 
concept of a fixed, nondeployable shield. 
Although the inherent weight advantages of 
a separable bumper are not available in this 
approach, the mission of Skylab could prob- 
ably be satisfied in this manner. One concept 
would be to bond an additional layer of metal 
skin to the surface of the tank with a layer of 
nonventing foam between the orbital work- 
shop tank and the external skin. The prob- 
lem being statistical in nature, the entire 
shell of the orbital workshop would not have 
to be covered. 

Postulated Sequence of the Most 
Probable Failure mode 

The availability of flight data from the in- 
strumentation on the meteoroid shield and 
the vehicle disturbances, the design features 
of the meteoroid shield, the solar array sys- 
tem photographs taken in orbit, descriptions 
by the astronauts, and other information 
permit the following postulation of the prob- 
able sequence of events associated with the 
meteoroid shield failure. 

In Figure 4, sketches and details of sa- 
lient events are correlated to the roll rate 
data around the 63 second anomaly period. 
The events are designated on the figures by 
times which are consistent with the avail- 
able data. 

60.12 Seconds - Meteoroid shield liftoff 
and local inflation in the vicinity of the aux- 
iliary tunnel was indicated by a small shift 
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in position of the torsion rod on the forward 
edge just to the left of the tunnel. 

61.78 Seconds - Air entered the forward 
fairing opening, raised the pressure under 
the shield and high mass flows escaped 
through the adjacent holes in the butterfly 
hinge. This flow produced reactive force 
causing a gradual decrease in roll rate be- 
tween 61.78 seconds and 62.74 seconds. 

62.74 to 62.79 Seconds - Burst pressure 
under the auxiliary tunnel and adjacent me- 
teoroid shield caused a large tangential load 
on the forward section of the butterfly hinge, 
causing the whole hinge to unzip. Fly around 
inspection indicated that the failure of the 
butterfly hinge occurred at the hinge line ad- 
jacent to the main tunnel. 

The butterfly hinge was now completely 
broken. Aerodynamic drag on the meteoroid 
shield including the bulky auxiliary tunnel 
produced tension in the shield and pulled on 
the vehicle so as to roll it in the direction 
shown, that is, opposite to that noted earlier. 
The large area and mass of this metal flag 
induced a more rapid change in roll rate than 
the earlier jetting through the butterfly 
hinge. This process terminated as the mete- 
oroid shield started to wrap around and lift 
the SAS-2 wing. 

62.79 to 62.90 Seconds - During this in- 
terval the shield was wrapping around the 
SAS-2 wing producing a negative roll torque 
in the vehicle. At about 62.85 seconds the 
SAS-2 tie-downs were broken. 

62.90 Seconds - Upon release of the 
SAS-2, the tension in the shield was trans- 
ferred to the trunnions, causing failure of the 
trunnion straps. Upon separation of this sec- 
tion of the shield, the negative roll torque 
ended. 

62.90 to 62.95 Seconds - In this interval, 
the remaining section of the meteoroid shield 
began unwinding, introducing a large posi- 
tive roll torque. 

63.17 Seconds - A large shock was detect- 
ed by the instrument unit upper mounting 
ring vibration sensor due to the impact of the 
separated section of the meteoroid shield 


upon the conical adapter between the orbital 
workshop and the SAS-1 stage. 

63. 7 Seconds - The meteoroid shield con- 
tinued to unwind and whip until 63.7 sec- 
onds when it reached SAS-1 wing. As the me- 
teoroid shield began to wrap around the 
SAS-1 wing, a negative roll torque resulted. 
The meteoroid shield then ripped apart from 
top to bottom at the longitudinal joint adja- 
cent to SAS-1, pulling a portion of the joint 
assembly over the SAS-1 wing as the meteor- 
oid shield section departed. From this point 
on the vehicle showed normal response to its 
roll control system. 

Possible Impact of Costs and 
Schedules on the Meteoroid Shield 

The origin of Skylab in late 1966 — as an ex- 
tension of the use of Apollo hardware for ex- 
periments in Earth orbit — imposed an initial 
environment of limited funding and strong 
schedule pressures on the program. Skylab, 
then designated the Apollo Applications Pro- 
gram (AAP), was to fit in among the Apollo 
flights under schedules imposed by the main- 
line Apollo program. Funding was provided 
out of the Apollo program and thus the needs 
of Skylab competed with those of the higher 
priority Apollo program. 

The situation changed in mid-1969 when 
Skylab became a major line item in its own 
right and was to use a Saturn-V launch vehi- 
cle with a dedicated, dry, orbital workshop. 
From that point on, increased funding and 
new flight schedules were established for 
Skylab. Nonetheless, the original concept of 
the meteoroid shield was retained when the 
orbital workshop changed from Saturn-IB 
propulsion stage to a dry workshop launched 
by a Saturn-V. The Board was therefore 
interested in determining the extent, if any, 
that either the initial limitation of funds and 
time, or any subsequent limitations, deter- 
mined the design or thoroughness of develop- 
ment of the meteoroid shield. This inquiry 
was limited to the possible effect of funding 
and schedule of the meteoroid shield as 
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designed and flown on Skylab 1 and did not 
consider whether meteoroid protection could 
have or should have been provided in some 
other way had the program not evolved as it 
did. 

In the Board’s review of the evolution of 
the meteoroid shield from initial design con- 
cept, through testing and development, to fi- 


nal assembly for flight, particular attention 
was devoted to any impacts arising from 
limitation of funds or time. Extensive discus- 
sions were also held with management per- 
sonnel of MDAC-W, MSFC, JSC, and NASA 
Headquarters on this matter. In no instance 
could the Board find any evidence that the 
design or testing of the meteoroid shield was 
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compromised by lack of funds or time. Pro- 
gram personnel, both government and 
contractor, had full confidence in the basic 
concept of the meteoroid shield and thus saw 
no need to alter the design when the change 
to a dry, Saturn-V launched orbital work- 
shop occurred. Given the concept that the 
shield was to be maintained tight to the or- 
bital workshop tank, and thus structurally 
integrated with the well-established S-IVB 
structure, the emphasis of testing given to 
ordnance reliability and shield deployment 
was considered proper. Neither the records of 
Skylab nor the memories of key personnel 
revealed any tests or analyses of the meteor- 
oid shield that were considered desirable at 
the time and which were precluded by lack of 
funds or time. 

The Skylab Management System 

The management system utilized for the 
Skylab program was derived directly from 
that which had been developed and used in 
the Apollo program. As such, it included a 
series of formal reviews and certifications at 
progressive points in the program life cycle 
that are intended to provide visibility to con- 
tractor and NASA management on program 
status, problems and their resolution. The 
selected review points and their primary 
purpose are set forth in Skylab Program 
Directive No. 11 A, which is summarized as 
follows: 

Preliminary Requirements Review (PRR). 
“To verify by formal review the suitability of 
the conceptual configuration and to establish 
the requirements and action necessary to 
achieve a design baseline.” 

Preliminary Design Review (PDR). “To 
verify by formal review the suitability of the 
baseline design of the Contract End Item.” 

Critical Design Review (CDR). “To verify 
by formal review the suitability of the design 
of a Contract End Item when the design is es- 
sentially complete.” 

Configuration Inspection (Cl). “To certify 
that the configuration for the Contract End 


Item as being offered for delivery is in confor- 
mance with the baseline established at the 
CDR.” 

Certification of Flight Worthiness 
(COFW). “To certify that each flight stage 
module and experiment is a complete and 
qualified item of hardware prior to ship- 
ment.” 

Design Certification Review (DCR). “To 
examine the design of the total mission com- 
plex for proof of design and development ma- 
turity.” 

Flight Readiness Review (FRR). “A con- 
solidated review of the hardware, operation- 
al and support elements to assess their 
readiness to begin the mission.” 

The primary thrust of these key program 
milestones is thus a formal review and certi- 
fication of equipment design or program sta- 
tus; the primary purpose being served is to 
provide visibility into these matters to senior 
NASA and contractor program manage- 
ment. As noted in the Skylab Program Direc- 
tive, the organization and conduct of the 
review is a major responsibility of a senior 
program or management official. For each 
review, specific objectives are to be satisfied, 
in conformance with preestablished criteria 
and supported by specified documentation. 
The reviews are thus highly structured and 
formal in nature, with a major emphasis on 
design details, status of various items and 
thoroughness of documentation. Several 
hundred specialists, subsystem engineers 
and schedule managers are generally in at- 
tendance. 

The material presented in these reviews 
is, of course, developed over a period of time 
in many lower-level reviews and in monthly 
progress reports dealing with various sys- 
tems and subsystems. In addition, several 
other major reviews peculiar to Skylab were 
conducted, including the following: 

• Cluster System Review of December 1967 

• Mathew’s Subsystem Review Team of 

August 1970-July 1971 
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• Critical Mechanisms Review of March 

1971 

• Systems Operations Compatibility 

Assessment Review of October 1971 -June 

1972 

• Structural/Mechanical Subsystem 
Reviews of July 1971-May 1972 

• Hardware Integrity Review of March 

1973 

• MSFC Center Director’s Program 

Reviews 

There was thus no shortage of reviews. In 
order to determine the consideration given to 
the meteoroid shield throughout the pro- 
gram, the Board examined the minutes, pre- 
sentation material, action items, and 
closeout of data of each of these reviews and 
progress reports. In every case, complete 
records and documentation were available 
for inspection. In no case did the Board un- 
cover any conflict or inconsistency in the 
record. All reviews appeared to be in com- 
plete conformance to Program Directive 11A 
and were attended by personnel appropriate 
to the subject matter under consideration. 
The system was fully operational. 

And yet, a major omission occurred 
throughout this process — consideration of 
aerodynamic loads on the meteoroid shield 
during the launch phase of the mission. 
Throughout this six year period of progres- 
sive reviews and certifications the principal 
attention devoted to the meteoroid shield 
was that of achieving a satisfactory deploy- 
ment in orbit and containment of the ord- 
nance used to initiate the deployment. As 
noted in the preceding section on possible 
failure modes, design attention was also giv- 
en to the strength of the hinges, trunnion 
straps and bolts, to the crushing pressures on 
the frames of the auxiliary tunnel, to flutter 
and to the venting of both the auxiliary 
tunnel and the several panels of the shield. 
But never did the matter of aerodynamic 
loads on the shield or aeroelastic interactions 
between the shield and its external pressure 
environment during launch receive the at- 


tention and understanding during the design 
and review process which in retrospect it de- 
served. 

This omission, serious as it was, is not 
surprising. From the beginning, a basic de- 
sign concept and requirement was that the 
shield be tight to the tank. As clearly stated 
in much of the early documentation, the me- 
teoroid shield was to be structurally integral 
with the S-IVB tank — a piece of structure 
that was well proven in many previous 
flights. The auxiliary tunnel frames, the con- 
trolled torque on the trunnion bolts and the 
rigging procedure itself were all specifically 
intended to keep the shield tight against the 
tank. The question of whether the shield 
would stay there under the dynamics of 
flight through the atmosphere was simply 
not considered in any coordinated manner — 
at least insofar as the Board could determine 
by this concentrated investigation. 

Possibly contributing to this oversight 
was the basic view of the meteoroid shield as 
a piece of structure. Organizationally, re- 
sponsibility for the meteoroid shield at 
MDAC-W was established to develop it as 
one of the several structural subsystems, 
along with such items as spacecraft struc- 
ture and penetrations, pressure vessels, sci- 
entific airlocks, protective covers and fin- 
ishes. Neither the government, (MSFC), or 
the contractor, (MDAC-W), had a full-time 
subsystem engineer assigned to the meteor- 
oid shield. While it is recognized that one 
cannot have a full-time engineer on every 
piece of equipment, it is nonetheless possible 
that the complex interactions and integra- 
tion of aerodynamics, structure, rigging 
procedures, ordnance, deployment mecha- 
nisms, and thermal requirements of the me- 
teoroid shield would have been enhanced by 
such an arrangement. Clearly, a serious fail- 
ure of communications among aerodynamics, 
structures, manufacturing and assembly 
personnel, and a breakdown of a systems 
engineering approach to the shield, existed 
over a considerable period of time. Further, 
the extensive management review and 
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certification process itself, in its primary 
purpose of providing visibility of program 
status to management, did not identify these 
faults. 

Further insight into this treatment of the 
meteoroid shield as one of several structural 
subsystems is obtained by a comparison of a 
listing of the design reviews conducted on 
both the meteoroid shield and the solar array 
system. At MDAC-W, the solar array system 
was considered a major subsystem and was 
placed under the direction of a full-time pro- 
ject engineer. 

The Board is impressed with the thor- 
oughness, rigor and formalism of the man- 
agement review system developed by Apollo 
and used by Skylab. Great discipline is im- 
posed upon everyone by this system and it 
has served very well. In a large program as 
geographically dispersed and intrinsically 
complex as Skylab, such visibility of pro- 
gram status and problems is a management 
necessity. We therefore have no wish to alter 
this management system in any basic man- 
ner. But all systems created by humans have 
their potential flaws and inherent hazards. 
Such inherent flaws and weaknesses must be 
understood by those who operate the system 
if it is not to become their master. We there- 
fore wish to identify some of those potential 
flaws as they have occurred to us in this in- 
vestigation, not to find fault or to identify a 
specific cause of this particular flight failure 
but to use this experience to further 
strengthen the management processes of 
large and complex endeavors. 

As previously noted, the management 
system developed by NASA for manned 
space flight places large emphasis on rigor, 
detail and thoroughness. In hand with this 
emphasis comes formalism, extensive docu- 
mentation, and visibility in detail to senior 
management. While nearly perfect, such a 
system can submerge the concerned individ- 
ual and depress the role of the intuitive engi- 
neer or analyst. It may not allow full play for 
the intuitive judgment or past experience of 
the individual. An emphasis on a manage- 


ment system, can, in itself, serve to separate 
the people engaged in the program from the 
real world of hardware. To counteract these 
potential hazards and flaws, we offer the fol- 
lowing suggestions. 

• Deployable systems or structures that 
have to move, or that involve other 
mechanisms, devices, or components in 
their operation, should not be considered 
as a piece of structure or be the basic re- 
sponsibility of a structures organization. 

• A complex, multi-disciplinary system 
such as the meteoroid shield should possi- 
bly have a designated project engineer 
who is responsible for overseeing all as- 
pects of analysis, design, fabrication, test 
and assembly. 

• Management must always strive to coun- 
teract the natural tendency of engineers 
to believe that a drawing is the real 
world. First-hand experience with how 
hardware behaves and can fail is of the 
essence to design engineers. Possibly, 
some design engineers should be required 
to spend time in testing, operations, or 
failure analysis. Such experience may not 
contribute to cleverness or sophistication 
of analysis, but something equally 
valuable — actual experience — may be ad- 
ded to the design group. An unfamiliarity 
with hardware, first hand, makes it diffi- 
cult to conceptualize a living, breathing, 
piece of hardware from an analysis or a 
drawing. 

• The extensive use of the computer for 
complex analyses can serve to remove the 
analyst from the real world. One should, 
therefore, require a simplified or support- 
ing analysis that provides an understand- 
able rationale for the phenomena under 
consideration before accepting the results 
of a computer analysis. 

• The emphasis on “visibility to manage- 
ment” in the review process should not be 
extended to the point that one can be led 
to believe the job is completed, or the de- 
sign is satisfactory, when such visibility 
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is provided. A major emphasis on status, 
on design details, or on documentation 
can detract from a productive examina- 
tion of “how does it work” or “what do you 
think.” 

• Today’s organizations seldom include the 
old-fashioned chief engineer who, rela- 
tively devoid of administrative or man- 
agerial duties, brings total experience 
and spends most of the time in the subtle 
integration of all elements of the system 
under purview. Perhaps we should more 
actively seek and utilize these talented 
individuals in an engineering organiza- 
tion. 

Significant findings 

1) The launch anomaly that occurred at ap- 
proximately 63 seconds after lift-off was 
a failure of the meteoroid shield of the 
orbital workshop. 

2) The SAS-2 wing tie downs were broken 
by the action of the meteoroid shield at 
63 seconds. Subsequent loss of the SAS-2 
wing was caused by retro-rocket plume 
impingement on the partially deployed 
wing at 593 seconds. 

3) The failure of the S-II interstage adapter 
to separate in flight was probably due to 
damage to the ordnance separation de- 
vice by falling debris from the meteoroid 
shield. 

4) The most probable cause of the failure of 
the meteoroid shield was internal pres- 
surization of its auxiliary tunnel. This 
internal pressurization acted to force the 
forward end of the tunnel and meteoroid 
shield away from the orbital workshop 
and into the supersonic air stream. The 
resulting forces tore the meteoroid 
shield from the orbital workshop. 

5) The pressurization of the auxiliary tun- 
nel resulted from the admission of high 
pressure air into the tunnel through 
several openings in the aft end. These 
openings were: (1) an imperfect fit of the 
tunnel with the aft fairing; (2) an open 


boot seal between the tunnel and tank 
surface; and (3) open stringers on the aft 
skirt under the tunnel. 

6) The venting analysis for the tunnel was 
predicated on a completely sealed aft 
end. The openings in the aft end of the 
tunnel thus resulted from a failure to 
communicate this critical design feature 
among aerodynamics, structural design, 
and manufacturing personnel. 

7) Other marginal aspects of the design of 
the meteoroid shield which, when taken 
together, could also result in failure dur- 
ing launch are: 

a) The proximity of the meteoroid 
shield forward reinforcing angle to 
the air stream 

b) The existence of gaps between the or- 
bital workshop and the forward ends 
of the meteoroid shield 

c) The light spring force of the auxil- 
iary tunnel frames 

d) The aerodynamic crushing loads on 
the auxiliary tunnel frames in flight 

e) The action of the torsion-bar actu- 
ated swing links applying an out- 
ward radial force to the meteoroid 
shield 

f) The inherent longitudinal flexibility 
of the shield assembly 

g) The nonuniform expansion of the 
orbital workshop tank when pressur- 
ized 

h) The inherent difficulty in rigging for 
flight and associated uncertain ten- 
sion loads in the shield. 

8) The failure to recognize many of these 
marginal design features through six 
years of analysis, design and test was 
due, in part, to a presumption that the 
meteoroid shield would be “tight to the 
tank” and “structurally integral with 
the S-IVB tank” as set forth in the 
design criteria. 

9) Organizationally, the meteoroid shield 
was treated as a structural subsystem. 
The absence of a designated project engi- 
neer for the shield contributed to the 
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lack of effective integration of the 
various structural, aerodynamic, aeroe- 
lastic, test fabrication, and assembly 
aspects of the meteoroid shield system. 

10) The overall management system used 
for Skylab was essentially the same as 
that developed in the Apollo program. 
This system was fully operational for 
Skylab; no conflicts or inconsistencies 
were found in the records of the manage- 
ment reviews. Nonetheless, the signifi- 
carce of the aerodynamic loads on the 
meteoroid shield during launch was not 
revealed by the extensive review pro- 
cess. 

11) No evidence was found to indicate that 
the design, development and testing of 
the meteoroid shield were compromised 
by limitations of funds or time. The 
quality of workmanship applied to the 
meteoroid shield was adequate for its 
intended purpose. 

12) Given the basic view that the meteoroid 
shield was to be completely in contact 
with and perform as structurally inte- 
gral with the S-IVB tank, the testing 
emphasis on ordnance performance and 
shield deployment was appropriate. 

13) Engineering and management person- 
nel on Skylab, on the part of both con- 
tractor and government, were available 
from the prior Saturn development and 
were highly experienced and adequate 
in number. 

14) The failure to recognize these design 
deficiencies of the meteoroid shield, as 
well as to communicate within the pro- 
ject the critical nature of its proper vent- 
ing, must therefore be attributed to an 
absence of sound engineering judgment 
and alert engineering leadership con- 
cerning this particular system over a 
considerable period of time. 

Corrective actions 

1) If the backup orbital workshop or a simi- 
lar spacecraft is to be flown in the 


future, a possible course of action is to 
omit the meteoroid shield, suitably coat 
the orbital workshop for thermal con- 
trol, and accept the meteoroid protection 
afforded by the orbital workshop tank 
walls. If, on the other hand, additional 
protection should be necessary, the 
Board is attracted to the concept of a 
fixed, nondeploy able shield. 

2) To reduce the probability of separation 
failures such as occurred at the S-II in- 
terstage Second Separation Plane, both 
linear shaped charges should be detonat- 
ed simultaneously from both ends. In 
addition, all other similar ordnance 
applications should be reviewed for a 
similar failure mode. 

3) “Structural” systems that have to move 
or deploy, or that involve other mecha- 
nisms, equipment or components for 
their operation, should not be the exclu- 
sive responsibility of a structures orga- 
nization. 

4) Complex, multi-disciplinary systems 
such as the meteoroid shield should have 
a designated project engineer who is 
responsible for all aspects of analysis, 
design, fabrication, test and assembly. 

Observations on the 
Management System 

The Board found no evidence that the design 
deficiencies of the meteoroid shield were the 
result of, or were masked by, the content and 
processes of the management system that 
were used for Skylab. On the contrary, the 
rigor, detail, and thoroughness of the system 
are doubtless necessary for a program of this 
magnitude. At the same time, as a caution- 
ary note for the future, it is emphasized that 
management must always be alert to the po- 
tential hazards of its systems and take care 
that an attention to rigor, detail and thor- 
oughness does not inject an undue emphasis 
on formalism, documentation, and visibility 
in detail. Such an emphasis can submerge 
the concerned individual and depress the 
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role of the intuitive engineer or analyst. It 
will always be of importance to achieve a 
cross-fertilization and broadened experience 
of engineers in analysis, design, test or oper- 
ations. Positive steps must always be taken 
to assure that engineers become familiar 
with actual hardware, develop an intuitive 
understanding of computer-developed re- 


sults, and make productive use of flight data 
in this learning process. The experienced 
chief engineer, whose time can be spent in 
the subtle integration of all elements of the 
system under review, free of administrative 
and managerial duties, can also be a major 
asset to an engineering organization. 
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